TheLeaf Threat Observatory operates honeypot sensors that mimic common internet services such as WordPress, Tomcat, phpMyAdmin, SMTP, Telnet, and RDP to capture unsolicited traffic and automated probing attempts. These sensors collect data on login attempts, credential guessing, and exploitation probes, publishing categorized observations with a delay. The project aims to provide real-world insight into automated scanning and attack techniques without enabling actual exploitation or access. It serves as an educational and research tool rather than a direct threat or vulnerability.
A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to destinations that appear on a configured allowlist. The allowlist decision was evaluated in a place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.
Critical9.2KEVEPSS 82%Check Point ResearchCVE-2026-111497
This report summarizes multiple significant cyber threats and incidents disclosed in early November 2026. Major breaches include a $6.3 billion cryptocurrency theft from Binance via compromised internal infrastructure, a malicious JavaScript attack on Polymarket's platform, and data breaches affecting Japan Airlines and the Florida Department of Education. The report also highlights the use of AI by threat actors such as the GOLD OGRE ransomware group and North Korean cyber operators to enhance attack capabilities. Several critical vulnerabilities are noted, including CVE-2026-111497 (HTTP2Shell) affecting Brotli decompression, a critical Linux kernel TCP networking flaw (CVE-2026-98432), and a Drupal Commerce Core access control vulnerability (CVE-2026-118539). Cisco patched a high-severity SSL VPN crash vulnerability (CVE-2026-76418) that was exploited in the wild. Additional threat intelligence includes malware campaigns and advanced persistent threat activity targeting various sectors globally.
A malicious file identified by the SHA-256 hash 58c8e25de53f0b4c9afee286556cc8d70d7a7f4900689ab09454640af01aa7cd was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the T1105 technique (Ingress Tool Transfer) and was seen originating from infrastructure in France. This hash corresponds to a specific malicious payload such as a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to check this hash against their environments and security tools to detect potential compromise.
A malicious file identified by the SHA-256 hash d8e47c699b68eac208cb265deb82902f613cee0391549f14f94f1c3305b6fb93 was observed twice on November 2, 2026, by OffSeq Mirage honeypot sensors. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was located in France. This hash can be used to detect the presence of this malicious file in environments and security tools.
The tailwindcss-animate-bridge npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not eliminate all malicious software, as the attacker may have gained full control of the system.
The npm package @utilitycraft/tailwindcss-motion-atelier contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing checks that this child identity actually belongs to the CA making the request.
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, gives the child any of that CA's resources, and creates the ROAs given in the request
The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill restart, so the same (key, nonce) pair is used again after each restart.
Two denial of service vulnerabilities have been identified in the Qt software toolkit's qt5-qtbase package, specifically involving uncontrolled recursion in XML serialization (CVE-2026-11573) and XML parsing (CVE-2026-19248). These issues affect Red Hat Enterprise Linux 8 and related products. Red Hat has issued a security advisory and provided updates to address these vulnerabilities.
INFINITT PACS System Manager versions 3.0.11.3 and 3.0.11.5 contain multiple code execution vulnerabilities. CVE-2026-16305 allows a local low-privileged attacker to execute arbitrary commands with administrative privileges due to insecure file permissions on an update manifest file. CVE-2026-16306 allows remote code execution via a crafted imodular:// URI scheme that executes unsafe commands without proper validation. Both vulnerabilities have been fixed in versions 3.0.12.3 and 3.0.12.5.
CVE-2026-16306 is a remote code execution vulnerability in the IModular.exe URI handler of INFINITT Healthcare System Manager. An unauthenticated remote attacker can exploit this flaw by crafting a malicious imodular:// URI with attacker-controlled commands and arguments, potentially invoking unintended application functionality and executing arbitrary code. The vulnerability affects versions from 3.0.11.3 through 3.0.11.5 inclusive.
A security bypass vulnerability exists in the URI module for Perl due to incorrect hostname encoding caused by missing Unicode normalization. This issue affects Perl 5.32 as packaged by Red Hat Enterprise Linux 8. The vulnerability has been rated as moderate severity by Red Hat Product Security. A security update addressing this flaw is available for Red Hat Enterprise Linux 8 and its extended life cycle versions.
Two security vulnerabilities were identified in the python-urllib3 package used in Red Hat Enterprise Linux 10. One is a denial of service vulnerability caused by unbounded memory allocation in the chunk parser (CVE-2026-97689). The other allows traffic interception via HTTPS proxy TLS configuration override (CVE-2026-97687). Red Hat has released updates addressing these issues.
A moderate severity security vulnerability (CVE-2026-63996) has been identified in the Linux kernel's ethtool cmis component, where the code did not require an exact Command Descriptor Block (CDB) reply length. This flaw could potentially affect the kernel's handling of certain device communications. Red Hat has released a security update for Red Hat Enterprise Linux 10.2 Extended Update Support and related products to address this issue. The update requires a system reboot to take effect. Red Hat recommends applying this update promptly as kernel vulnerabilities can impact overall system security.
Chainlit version 2.12.0 has a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls restrictions. This occurs because the validate_mcp_url function does not reject semicolon characters, enabling attackers to craft MCP URLs with '..;' path segments. These specially crafted requests to the /mcp endpoint can access paths outside the intended operator's grant on origins that strip semicolon path parameters.
Control Web Panel (CWP) versions prior to 1.16 contain critical vulnerabilities in the phpini_editor user panel module that allow arbitrary file write and OS command injection. These flaws enable an attacker with access to the module to write files to arbitrary paths and execute operating system commands without restrictions, leading to remote code execution.
Control Web Panel (CWP) versions before 1.12 have a critical execution after redirect vulnerability in the user panel authentication flow. This flaw allows attackers with only a valid hosting username to bypass authentication and execute code paths normally restricted to authenticated users, potentially leading to root access.
Wing FTP Server versions before 8.2.6 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated web-client users to inject malicious scripts via a crafted 'nowpath' parameter to the webclient/makethumb.html endpoint. Exploitation enables attackers to manipulate XML content in admin_get_lastconn.html, forging connection IDs that execute in administrators' browsers when admin_connection_list.html auto-refreshes. This can lead to abuse of the Lua console by administrators.